Caura Explained: Shared Memory for AI Agent Fleets

Key Takeaway

When scaling from single-agent LLM assistants to multi-agent fleets, shared context quickly encounters two competing failure modes: knowledge duplication across agents and unauthorized context leakage between tenants or execution boundaries. Caura (formerly known as MemClaw) addresses this challenge by serving as an open-source, Apache 2.0-licensed governed memory layer designed specifically for multi-tenant, multi-agent AI agent fleets.

Caura documents tenant isolation and permissioned sharing. These controls need validation in the selected identity and deployment configuration. Its primary tradeoff lies in background processing overhead: full semantic retrieval, knowledge graph extraction, and contradiction supersession require continuous background processing and LLM-driven enrichment routines compared to lightweight vector wrappers.

Governance Framework: Visibility Scopes and Trust Tiers

A shared memory design needs explicit visibility and access rules; vector storage alone does not determine those rules. According to the Caura repository documentation, Caura enforces multi-tenant row-level database isolation alongside automated PII detection on every write operation.

Memory Visibility Scopes

Every memory written to Caura is stamped with one of three explicit visibility scopes:

scope_agent: Private memory restricted strictly to the authoring agent.
scope_team: Shared memory accessible fleet-wide within the assigned team (the default write mode).
scope_org: Cross-fleet organizational memory subject to governance authorization and permission checks.

Agent Trust Tiers and Keystone Policies

To prevent unverified operational lessons from disrupting production flows, Caura implements four agent trust tiers controlling read, write, and deletion privileges across fleets. Furthermore, mandatory governance directives—termed keystone policies—override standard prompt instructions. Agents invoke caura_keystones upon session startup to retrieve mandatory operational constraints that take precedence over standard instructions.

Memory Pipeline, Knowledge Graph, and Hybrid Recall

Caura processes plain text input into structured, self-improving memory records through a single-pass LLM enrichment pipeline.

Enrichment and Memory Classification

The README describes classification into seven memory types and distinguishes server-written outcomes, rules and insights. The enrichment pipeline generates titles and summaries, scores importance, flags detected PII and extracts entities. Detection and classification are mechanisms to evaluate, not assurances that every sensitive or contradictory entry is identified.

Hybrid Search and Contradiction Resolution

Retrieval relies on a composite ranking mechanism:

Vector Similarity: Semantic matching using pgvector.
Keyword Match: Full-text PostgreSQL search for exact terms and code identifiers.
Graph Expansion: Knowledge graph traversal up to 2 hops.
Supersession Control: Direct RDF triple comparison and LLM analysis detect conflicting memories. When a replacement record exists, the README says the replacement ranks immediately above its superseded memory when both appear in a result set. That conditional ordering is not proof that every recall returns the correction or that every downstream answer uses it.

Setup and Practical Integration

Caura supports local single-tenant execution via Docker, Model Context Protocol (MCP) gateway integration, and programmatic agent orchestration using the Rail SDK.

Evaluation and Benchmark Results

Project-reported evaluations recorded in Caura's benchmark documentation demonstrate retrieval precision and token efficiency across standard long-context benchmarks.

LoCoMo Accuracy: Caura achieved 77.9% accuracy (1,199/1,540 correct) under its semantic-judge protocol utilizing the retrieval-augmented agentic-v1 pipeline.
LongMemEval Accuracy: Evaluated on the LongMemEval_S benchmark, Caura scored 92.2% (461/500) under the GPT-4o reference judge and 90.2% (451/500) under the secondary Gemini 3.5 Flash-Lite judge.
Context Efficiency: On LongMemEval_S, retrieved compact context averaged 22,410 tokens compared to the 107,706-token uncompressed haystack, representing a 79.2% reduction in prompt context overhead.

As noted in project documentation, public benchmarks like LoCoMo evaluate single-agent, single-conversation scenarios; multi-agent fleet governance requires validating context isolation and write latency in production environments.

Operational Considerations and Decision Guidance

When deciding whether Caura’s memory and governance model fits an application, consider:

Fleet Governance Need: Single-agent workloads can be managed with simpler memory libraries. Caura's primary value proposition emerges when multiple agents or external vendors share state across fleet boundaries subject to trust levels.
Background Service Requirements: Features such as background memory crystallization, automated skill synthesis via Skill Factory, and transcript synthesis via The Interviewer require dedicated background execution (core-operations service with Redis and PostgreSQL).
Credential Management: The README distinguishes managed-platform agent provisioning from self-hosted core-api behavior, which auto-registers agents on first write. Use the selected offering’s documented identity path and prefer attributable agent-scoped credentials; do not copy a managed-only provisioning route into a self-hosted setup.

A scope-and-supersession acceptance matrix

Suppose two support agents share team knowledge while each also holds a private operational note. Caura's scopes, trust tiers and supersession model suggest specific tests before sharing real customer context. Governed memory design

Memory case	Inspect	Required application outcome
An agent-private observation	Caller identity, scope and returned memories	An unrelated agent does not receive the private note
A team observation	Team membership and retrieved context	Intended peers can use the shared fact
A corrected fact with an older contradictory entry	Both records and the selected context	The answer uses the current fact and preserves needed provenance

Exercise direct lookup as well as ranked recall. Hiding a record from the top search results is different from denying access to it. Include rejected writes and agent-identity changes to inspect the actual policy boundary, rather than inferring isolation from a scope label.

Use the setup path for the chosen self-hosted or managed offering; their agent-provisioning interfaces are not interchangeable. Public memory benchmarks do not establish tenant isolation or correct downstream answers. This matrix is a proposed validation procedure, not a completed security test or an independent reproduction of Caura's measurements.

Evidence and scope

Primary repository documentation was refreshed on 14 October 2026. The worked scenario is a planning exercise derived from documented behavior, not a product test. Reported measurements remain attributed to their source and workload.

caura README